Tomographic Quantum Cryptography: 
Equivalence of Quantum and Classical Key Distillation 
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The security of a cryptographic key that is generated by communication through a noisy quantum 
channel relies on the ability to distill a shorter secure key sequence from a longer insecure one. For an 
important class of protocols, which exploit tomographically complete measurements on entangled 
pairs of any dimension, we show that the noise threshold for classical advantage distillation is 
identical with the threshold for quantum entanglement distillation. As a consequence, the two 
distillation procedures are equivalent: neither offers a security advantage over the other. 
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The ability to generate a secure cryptographic key, al- 
though the communication employs a quantum channel 
with a high level of noise, is crucial for all practical imple- 
mentations of quantum cryptography. To be on the safe 
side, one must assume that all noise results from eaves- 
dropping, that eavesdropper Eve has full knowledge of 
the cryptographic protocol (the "Kerckhoff principle" of 
cryptology), and that she acquires as much knowledge 
about the communication as is allowed by the laws of 
physics. This leads immediately to the question of where 
is the noise threshold below which a secure key can be 
generated at all. We give a definite answer for an impor- 
tant class of protocols, restricting, however, the discus- 
sion to incoherent attacks of the eavesdropper. 

In the cryptographic protocol that we consider Q] , Al- 
ice and Bob exploit entangled pairs of qunits, that is: 
n-fold quantum alternatives, the case of n — 2 being the 
elementary binary alternative of a qubit. Alice measures 
on her qunit, and Bob on his, an observable randomly 
chosen from their respective sets of n + 1 observables 
that are tomographically complete. Such sets surely ex- 
ist for any dimension Adopting the notation of 
we write mfe) for the fc-th eigenket of Alice's 771-th ob- 
servable and \ fnk) for the fc-th eigenket of Bob's m-th ob- 
servable, whereby m = 0, 1, . . . ,n and k = 0, 1, . . . ,n— 1. 

It is possible and expedient to choose these kets such 
that (Oj\mk) = (mk\0j) for all m,j,k, and then the 
maximally entangled 2-qunit state that Alice and 
Bob wish to share, 



for the generation of a key in an alphabet with 77 letters. 

On average, the measurement bases will be matched for 
a fraction 1/(77 + 1) of the qunit pairs, and these data will 
supply the raw key sequence. Alice and Bob use part of it 
together with all the other measurement data, acquired 
for mismatched bases, to perform quantum tomography 
on the two-qunit state they are actually receiving from 
the source. The tomographic completeness of the two sets 
of observables is crucial for this part of the procedure. 

Alice and Bob assume that Eve distributes the qunits. 
They accept the raw key only if the result of their 
state tomography is consistent with an admixture of the 
chaotic state to thereby forcing Eve to use a 

symmetric strategy. In other words, they accept only 
a 2-qunit state p of the form 

p=^ o -0 1 )\i>)(i>\ + ^I, /3o + (n-l)/3i = l, (2) 

where / is the 2-qunit identity operator, /3 is the prob- 
ability that Bob gets the same value as Alice when the 
bases match, and fli is the probability that he gets a par- 
ticular other one. Since /3o — Pi — I/77 when there are 
no correlations whatsoever between their measurement 
results, we take (3$ > 1 jn > j3\ for granted. 

Although Eve fully controls the 2-qunit source, she is 
not free in her actions, because the state received by Alice 
and Bob must be of the form @. One finds [l| that, 
therefore, the best Eve can do is to prepare an entangled 
pure state of the form 
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4= EM*> = ' ' ' = -7=EM*> - (!) I*> = V n EI°*°*>I E **> + V ^EI°^)|E«) , (3) 



has the same appearance irrespective of the pair of ob- 
servables that is used to define it. Therefore, their mea- 
surement results in the matched bases (same value of m 
for her and him) are perfectly correlated and can be used 



where her normalized ancilla states |Efc^ are such that 
those with fc 7^ I are orthogonal to all others, whereas 
those with fc = I are not orthogonal among themselves, 
but obey (E fefe |E«) = 1 - (/3i//3 )(l - S k i). Thus the 
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summations in © constitute two orthogonal components 
of The n-dimensional first component is relevant for 
establishing the cryptographic key, the n(n — 1 ^dimen- 
sional second component is just noise to Alice and Bob. 

We note that the invariance of lip} under bases permu- 
tations is also possessed by Rather than referring to 
the 0-th pair of observables, we could just as well use the 
joint eigenkets \mkrni) of any other pair in conjunction 
with a suitable unitary redefinition of the ancilla states. 

After Alice and Bob have given public notice of the 
observables they measured for each qunit pair, it is 
Eve's task to infer their measurement results — their nit 
values — whenever the bases match. To this end she must 
be able to identify her ancilla states. (Remember that we 
are only considering incoherent eavesdropping attacks.) 
Owing to the structure of she can distinguish unam- 
biguously all the states belonging to the second orthogo- 
nal component, and so she can correctly infer Alice's and 
Bob's nit values if they are different. But if they are the 
same, Eve has to distinguish the |Efcfc) of the first com- 
ponent, and then she cannot avoid errors because these 
states are not orthogonal to each other. In this situation, 
she minimizes her error probability by performing the so 
called square-root measurement 

We denote by 77 and 771 = (1 — rj Q )/(n — 1) the prob- 
abilities that Eve infers the nit value correctly or gets a 
particular wrong one, respectively, provided that Bob's 
nit value is the same as Alice's. They are related to Bob's 
probabilities Po and p\ of by 

s/vo~-Vm = VfoM- (4) 

Note that this expresses a certain complementarity be- 
tween Bob's and Eve's respective knowledge about Al- 
ice's nit values. If Bob's values agree perfectly with Al- 
ice's (Po = 1, j3\ = 0), then Eve's values are completely 
random (770 = r/i = l/n), and conversely 770 = 1, 771 = 
implies Po = pi = l/n. In the more interesting interme- 
diate situations we have 770 > l/n > 771 . 

For single-particle protocols with qubits (n — 2) or 
qutrits (n = 3), the relation Q is well established [a,E|, 
and has been conjectured to hold for arbitrary dimensions 
[HQ This conjecture is proved in 0]. 

According to the Csiszar-Korner (CK) Theorem a 
secure key sequence can be extracted from the raw key 
sequence if the mutual information between Alice and 
Bob exceeds the mutual information between either one 
of them and Eve. This requires that Bob's and Eve's 
probabilities are such that 

v = p log„ fa + (1 - /3 Q ) log„ Pi 

-po [rj log„ ?7o + (1 — Vo) log„ r?i] > , (5) 

and then v is the yield of the CK procedure, the fraction 
of nit values that make it from the raw key sequence to 
the secure one. Since (@J implies that 770,771 — > l/n as 
Po — > 1, this condition is surely met if Po is sufficiently 



large. If, however, there is too much noise in the 2-qunit 
state (J2J, the CK theorem is not immediately applicable. 
Rather, Alice and Bob must select a subsequence of nit 
values in a systematic way such that the CK theorem 
applies to the resulting "distilled key." 

One method at their disposal for this purpose is en- 
tanglement distillation (ED), a quantum procedure by 
which they produce a smaller number of qunit pairs with 
stronger entanglement, by means of local operations and 
classical communication @. Thus they can reach a po 
value for which the CK theorem is applicable, before they 
measure their respective observables. For states of the 
particularly simple structure @ , ED will be successful if 

Po > 2Pi (6) 

and only then . If Eve can perfectly compensate for 
the back effect of ED on the ancillas, relation also 
applies after ED. If she cannot, it turns into an inequality, 
tersely: = — * <. 

Alternatively, Alice and Bob can produce their raw key 
sequences without any subensemble selection, and then 
perform advantage distillation (AD) , a pro cedure of clas- 
sical (i.e. non-quantum) cryptography As we shall 
see below, for p , 770 values that obey (@J), AD is successful 
whenever (|HJ| holds, and only then, so that the thresholds 
for ED and AD are the same As a consequence of 
this coincidence, ED and AD are equivalent in the sense 
that neither offers a security advantage over the other. 

Both ED and AD require classical two-way commu- 
nication, but once the CK theorem becomes applicable, 
one-way communication suffices. We leave it as a moot 
point which method makes better use of the resources 
because the standard versions of both are very wasteful 
and hardly suited for practical implementation |l3| . 

The AD protocol is as follows. Alice and Bob divide 
their raw strings of nit values into blocks of length L. For 
each block, Alice casts a 71-sided die and then adds, mod- 
ulo n, the random value thus found to the given block. 
Then she sends these modified blocks to Bob through a 
public, but authenticated channel. Bob subtracts, mod- 
ulo 7i, his corresponding blocks. Whenever he obtains a 
block consisting of L identical nit values, he enters this 
value into his distilled sequence. If, however, different 
values appear in a block, he disregards it. He tells Alice, 
through the public channel, which blocks contribute to 
the distilled key and which don't. She in turn then forms 
her own distilled sequence from the random values that 
she added to the blocks that Bob did not discard. 

The two distilled sequences are identical, except at the 
rare positions, where Bob's whole block consisted of L 
wrong nit values of the same kind. Since there are 71 — 1 
different wrong nit values, the relative frequency with 
which a particular one occurs in the distilled sequence is 

Bl = p l + (n 1 - m ' (7) 
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which is, so to say, the new value of Pi after AD. Since 
Pi < (3o, Bl decreases exponentially with the block 
length L, 
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Whenever Alice and Bob end up with a pair of different 
nit values after AD, Eve knows both values correctly, 
because she knows the values for each nit pair of the 
two blocks in question. But when Alice and Bob get the 
same value, which is the much more frequent situation 
for long blocks, Eve cannot be completely sure about 
any nit value in the blocks. Her best strategy is then 
to subtract Alice's block from her corresponding block, 
that is, to do what Bob does. Typically, Eve's block 
is inhomogeneous after the subtraction, and it is highly 
likely that the correct nit value is the value that occurs 
more often than any other. So, she decides by a majority 
vote which nit value to assign: She bets on the value 
that appears most frequently in the block, and if there 
are several most frequent values, she picks one of them 
at random. 

To find her probability for assigning the right value, 
we first note that a block with to correct values and ki, 
k%, ■ ■ ■ , fcn-i ones of the n— 1 wrong kinds, respectively, 
occurs with a relative frequency that is given by 
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x=0 



where the Kronecker delta symbol enforces the constraint 
L - m = ki + k 2 + • • • + k n -i. 

Second, we note that Eve surely assigns a wrong value 
whenever m < maxjfci, . . . , fc„-i}, and in the situation of 
to > maxjfci, . . . , k n _i} she assigns the right value with 
probability 1/(1 + 1) where I is the count of kj's that are 
equal to m. With the combinatorial factor 
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taken into account, the summation over to and all kj thus 
gives 



m=0 



1 n_1 / n 



(?7ia;) T 



1 1 



dx 



m — l/ \u 

fa*) 



k=0 



k\ 



i-l-l 



x = 
(11) 



for the probability that Eve assigns the right nit value 
to a string of length L, and El is then the probability 



that she gets a particular one of the n — 1 wrong values. 
Parroting the remark after J7J), we note that El is, so to 
say, the new value of 771 after AD. 
We use the generating function 
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to deal with these probabilities as a set. It is given by 
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where 
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(14) 



is the partially summed Poisson distribution. 

For the comparison with (jSJ) , the quantity of primary 
interest is the limit 



lim ^ L+1 = li m ^- log E(t) 
l^oo E L *^o° dt K ' 



(15) 



which directs our attention to the large-i behavior of 
E(t). Now, for large t the Poisson distribution in to, by 
which the parenthesized difference is weig hted in fTSf l . 
has its peak at to ~ 770^ > r]it, and the relative width of 
this peak shrinks with growing t. Accordingly, all rele- 
vant contributions to the sum in (|13fl have m > rjit, so 
that the approximation 



is permissible, and 
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(16) 



E(t) ~ ie( 1 ^ ^ 1 )*Io(2Vwri) fort»l (17) 

obtains. Since there is no difference between the modified 
Bessel function Io(^) and its derivative li(z) when z 3> 1, 
this tells us that 



lim — ^ii = 1 — 

l^oo El 



(18) 



In conjunction with (jHJ, it follows that AD of this kind 
will be successful if 



- < 1 - (Vm-Vvi) 



(19) 



holds because then Bob's error probability gets exponen- 
tially smaller than Eve's with increasing block length L, 
and the distilled key sequence will meet the requirements 
of the CK theorem if L is chosen large enough. Now, if 
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FIG. 1: The three- fold coincidence, for n = 5, in a plot of 
Bob's probability /3o vs. Eve's probability 770 . The relevant 
values of /3o > 1/n and 7/0 > 1/n are outside the gray area. 
The dash-dotted curve a identifies the Po , 770 pairs for which 
holds. To the right of the dashed vertical line b, condi- 
tion © is obeyed and ED is possible. By contrast, AD can 
be successfully performed below the solid-line curve c which 
marks the border stated in 11911 . All three lines intersect at 
fa = 1/3 = 0.33, 770 = (11 + 4^6)/25 = 0.83, so that the 
part of curve a that is to the right of curve b is also the part 
that is below curve c. — The CK theorem is applicable to 
Po,r/o values below the dotted curve d that results from 10. 
It intersects curve a at /3o = 0.708, 7/0 = 0.470. From there, a 
single ED step takes one to the o point on curve a, whereas 
AD with L = 2 moves one horizontally to the o point further 
right (see 0). 

|@J relates Eve's probabilities to Bob's, as it is the case 
for the probabilities originating in Eve's source state J3J), 
the threshold condition l|19fl for classical AD is, indeed, 
identical with the threshold condition (jfJJl for quantum 
ED, as we have asserted above. This remarkable coinci- 
dence is illustrated in Fig. ^ 

It is important to note that, despite its simplicity and 
its lack of efficiency, the AD scheme considered correctly 
identifies the threshold point on curve a in Fig.^ For, if 
(A),?7o) is to the left of the triple-coincidence point, the 
2-qunit state (0) is separable. Eve can then blend it from 
product states and can so ensure that there is no useful 
mutual information between Alice and Bob, and without 
it they cannot generate a secure key. 

For n = 3, a more involved argument about the same 
matter is given in . In fact .while our paper was being 
written, we became aware of |j| where some of our results 
are conjectured and identical conclusions are reached. 
One wonders, of course, whether the surprising equiva- 
lence between classical and quantum distillation is more 
than just the coincidence as which it appears here and 



in pfl. Perhaps it hints at a deeper connection between 
these fundamentally different procedures. 

Finally, one might wonder if Eve has a better procedure 
at her disposal than the square-root measurement that 
is the basis of our analysis. For the following reasons 
we think she does not. The error-minimizing strategy 
takes full advantage of the built-in symmetry of the to- 
mographic protocol. For all other fully symmetric eaves- 
dropping attacks, the CK region is reached at smaller (3q 
values, and successful AD is possible for all of them if 
the ED threshold ijfjj is crossed ^ij. It seems, therefore, 
rather reasonable that the error-minimizing strategy is 
Eve's optimal choice. 
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